boot: drop pci=realloc from default/toram GRUB entries, fold into troubleshooting entry

pci=realloc was forcing a full PCI resource reallocation on every default
and toram boot, added as a GPU BAR workaround for BIOS without Above 4G
Decoding. On a dense NVMe-backplane server it exhausted MMIO32 space and
silently dropped 4 of 6 NVMe controllers from the OS even though the BIOS
and lspci both saw them fine. It now only applies to the no-GUI/gsp-off
troubleshooting entry, alongside a bible-local ADR for the two prior
rounds of SAT/blackbox durability work.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

bible-local/architecture/runtime-flows.md

@@ -167,6 +167,64 @@ Acceptance flows:
 - Runtime overrides:
   - `BEE_MEMTESTER_SIZE_MB`
   - `BEE_MEMTESTER_PASSES`
+- NVIDIA Bandwidth SAT (`RunNvidiaBandwidthPack`, `dcgmi diag -r nvbandwidth`) on a
+  multi-socket system runs per CPU socket first, then all selected GPUs together
+  (`03-dcgmi-nvbandwidth-socket0.log`, `...-socket1.log`, `...-all.log`) --
+  see `decisions/2026-07-27-nvbandwidth-per-socket-split.md`. Single-socket
+  systems (or systems where a GPU's NUMA node can't be resolved) keep the
+  original single `NN-dcgmi-nvbandwidth.log` shape.
+
+## SAT job output durability
+
+```
+runAcceptancePackCtx job loop (per satJob)
+  1. run the job's command; streamExecOutput writes each output line to the
+     job's log file as it arrives (not only when the process exits)
+  2. write the job's final log file (same content the live stream already
+     wrote, plus any health-check suffix)
+  3. call satJobBoundaryHook(jobName) if set
+  4. append run_at_utc / *_status to summary.txt
+```
+
+**Critical invariants:**
+- DO NOT change `streamExecOutput` back to buffering output in memory and
+  writing the job's log file only once, after the command exits -- see
+  `decisions/2026-07-27-sat-live-output-and-blackbox-kick.md`. The live ISO's
+  export directory sits on a `toram` RAM-backed overlay (see Boot sequence
+  above), so a crash mid-command is otherwise unrecoverable for that job.
+- `platform` never imports `app`; `SetJobBoundaryHook` is a plain
+  `func(string)` seam (same pattern as `satExecCommand`/`satStat`), not a
+  direct call into blackbox internals.
+
+## Blackbox sync flow
+
+```
+bee-blackbox.service (separate process from bee-web/bee-audit)
+  1. discover enrolled removable-media targets every blackboxDiscoverInterval (2s)
+  2. per enrolled target, blackboxWorker.run():
+       a. syncCycle(): mount target, mirror exportDir -> removable media,
+          write README.md/manifest docs, fsync
+       b. record lastKickSeen = mtime of exportDir/.blackbox-kick
+       c. wait for: the adaptive flushPeriod timer (1-30s), OR
+          a stop signal, OR
+          a poll tick (blackboxKickPollInterval, 250ms) showing the kick
+          file is newer than lastKickSeen -- whichever comes first
+  3. on kick-triggered wake: sync immediately, do not wait out the
+     remaining flushPeriod
+```
+
+**Critical invariants:**
+- `app.New()` wires `platform.SetJobBoundaryHook` to touch
+  `exportDir/.blackbox-kick` after every SAT job finishes. If a new SAT
+  execution path bypasses `runAcceptancePackCtx`'s job loop, it will not
+  trigger this kick -- data from that path still eventually reaches
+  blackbox via the adaptive timer, just not promptly.
+- The adaptive `flushPeriod` logic (`adjustFlushPeriod`) is unchanged by the
+  kick mechanism -- the kick only short-circuits the *wait*, it does not
+  reset `flushPeriod` itself.
+- DO NOT assume a local write under the live ISO's export directory is
+  durable on its own (RAM-backed overlay) -- blackbox's mirror to removable
+  media is the only real persistence boundary across a hard reset.
 
 ## NVIDIA SAT Web UI flow